Issue metadata
Sign in to add a comment
|
Security: [FG-VD-16-088] Adobe Flash Player Handing MP4 Out-of-Bounds Read Vulnerability
Reported by
kevinlu0...@gmail.com,
Dec 1 2016
|
||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS It is a out-of-bounds read vulnerability in MP4 processing. VERSION Adobe Flash Player 23.0.0.207 Other versions may be affected too REPRODUCTION CASE put LoadMP42.swf and FG-VD-16-088_PoC.mp4 on a server and load http://127.0.0.1:8080/LoadMP42.swf?file=FG-VD-16-088_PoC.mp4 run the following command line. flashplayer_23_sa_207.exe http://127.0.0.1:8080/LoadMP42.swf?file=FG-VD-16-088_PoC.mp4 Credits: This vulnerability was discovered by Kai Lu of Fortinet's FortiGuard Labs. Note: I tested this case and it can be reproduced stably in standalone player(pageheap enabled)and other browsers, such as Firefox , IE on Windows 10 Pro x64 and Windows 7 x64. Repros inconsistently on Chrome ,I need more time to investigate the reason.
,
Dec 1 2016
Reproduced the crash on Windows 7. Will report to Adobe.
,
Feb 13 2017
This was fixed as CVE-2017-2991
,
Feb 16 2017
This is PSIRT-6100.
,
Feb 20 2017
,
Feb 20 2017
,
Feb 21 2017
,
Feb 28 2017
,
Feb 28 2017
Congratulations! The panel decided to award $1,000 for this bug!
,
Feb 28 2017
,
Mar 1 2017
thanks!
,
Mar 31 2017
,
May 30 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 28
|
|||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||
Comment 1 by och...@chromium.org
, Dec 1 2016Status: ExternalDependency (was: Unconfirmed)